CN111541544A

CN111541544A - Quantum digital signature method based on double-field protocol

Info

Publication number: CN111541544A
Application number: CN202010200419.7A
Authority: CN
Inventors: 张春辉; 王琴
Original assignee: Nanjing University of Posts and Telecommunications
Current assignee: Nanjing University of Posts and Telecommunications
Priority date: 2020-03-20
Filing date: 2020-03-20
Publication date: 2020-08-14
Anticipated expiration: 2040-03-20
Also published as: CN111541544B

Abstract

The invention aims to provide a quantum digital signature method based on a double-Field protocol, which utilizes a double-Field key generation protocol (TF-KGP, two-Field KGP) to complete the generation and distribution of a key in the key distribution stage of quantum digital signature, and a user sends a quantum state to a special measuring party for measurement without the need of obtaining the credibility of the measuring party. From the perspective of safety, the quantum digital signature system has the irrelevant property of the measuring equipment due to the use of the TF-KGP, can resist side channel attack aiming at the measuring equipment, and improves the safety of the quantum digital signature system; from the practical point of view, under the same parameter condition, the number of the secret keys which can be used for signature is greatly increased, so that the safe transmission distance of the signature and the signature rate at a remote position are improved, and the practical performance of the quantum digital signature system is improved.

Description

Quantum digital signature method based on double-field protocol

Technical Field

The invention relates to the technical field of quantum information technology and network information security, in particular to a quantum digital signature method based on a double-field protocol.

Background

Digital signatures are one of the most important cryptographic protocols and have wide application in verifying the authenticity and integrity of digital documents such as financial transactions and electronic contracts. Current digital signatures (hereinafter referred to as classical digital signatures) can only provide security based on computational complexity. For example, the security of the RSA algorithm relies on the large number factorization problem, while the elliptic curve algorithm relies on the computational difficulty of discrete logarithms. However, with the development of mathematical algorithms and the advent of quantum computers, these classical digital signature algorithms will eventually be broken.

The security of Quantum Digital Signature (QDS) is based on the Quantum mechanical law, and can provide security in the aspect of information theory. Since the first QDS protocol was proposed in 2001, researchers have eliminated many practical obstacles such as quantum memory, secure quantum channels, etc. Meanwhile, scientific researchers propose that a quantum Key distribution Protocol can be used as a Key Generation Protocol (KGP) in the QDS, and the experiment implementation difficulty of the QDS is reduced. In addition, the Measurement Device-dependent quantum digital signature (MDI-QDS) protocol can immunize any side channel attack against the Measurement Device. However, the conventional QDS protocol is difficult to satisfy both security and practicability, and has certain limitations. For example, the BB84 type QDS (BB84-QDS) protocol has a high signature rate, but cannot resist side channel attack on a measuring end, and has low security; the MDI-QDS protocol has higher security, but has a very limited signature rate. Most importantly, KGP in both types of QDS protocols cannot break the linear bound between key generation rate and distance when no quantum repeater is used, which is an upper bound determined by channel capacity.

Disclosure of Invention

The invention aims to provide a quantum digital signature method based on a double-Field protocol, which utilizes a double-Field key generation protocol (TF-KGP, two-Field KGP) to complete the generation and distribution of a key in the key distribution stage of quantum digital signature, and a user sends a quantum state to a special measuring party for measurement without the need of obtaining the credibility of the measuring party. Due to the use of the TF-KGP, the security irrelevant to the measuring equipment is possessed, and side channel attack aiming at the measuring equipment can be resisted; in addition, compared with BB84-QDS and MDI-QDS, the invention greatly improves the transmission distance of the signature and the signature rate at a long distance.

The invention provides a quantum digital signature method based on a double-field protocol, which adopts the double-field protocol to generate and sign a secret key and is applied to a Quantum Digital Signature (QDS) transmission system, the method comprises a secret key distribution stage and an information stage, wherein the secret key distribution stage comprises user parties Alice, Bob, Charlie and a measuring party Eve, in the secret key distribution stage, Alice, Bob and Charlie are quantum state senders, and Eve is a quantum state receiving and measuring party; the key distribution phase comprises the following three steps:

the method comprises the following steps: respectively sending the quantum state to Eve for measurement by Alice and Bob, Alice and Charlie, generating an original key by using a double-field key generation protocol, randomly selecting part of bits from the original keys held by Alice and Bob, and using the rest of bits as a key pool for signature; defining the lengths of the original key, the error rate detection and the key pool as n respectively_Z、n_testAnd n_pool(ii) a The quantum channel formed among Alice, Eve and Bob is considered as Alice-Bob, the quantum channel formed among Alice, Eve and Charlie is considered as Alice-Charlie, and the error rate of Alice-Bob is defined as

Alice-Charlie with a bit error rate of

Step two: and signing the message m, wherein m is 0 or 1, and Alice and Bob or Alice and Charlie respectively select bit strings with the length of L from a key pool of the message m, and the bit strings selected by Alice and Bob are respectively recorded as

And

the bit strings selected by Alice and Charlie are respectively

And

step three: bob and Charlie from

And

randomly selecting one half of reserved bits, and exchanging the other half of bits and bit position information through a secure private channel between the two bits; let Bob reserve bit information as

The bit information sent to Charlie is

Let Charlie retain bit information as

The bit information sent to Bob is

After the exchange, Bob's key string is

Charlie has a key string of

In the information phase, Alice serves as a signer, and Bob and Charlie serve as verifiers, namely a signer receiving party; the information phase comprises the following four steps:

step four: alice signs the information (m, Sig)_m) Sent to Bob, where Sig_mRepresenting the signature on the message m,

step five: bob will receive the signature (m, Sig)_m) And

comparing if

In (1)

Respectively with signature

The number of mismatching of the corresponding position bits is less than s_aL/2, Bob accepts the signature and carries out the next step, otherwise refuses the signature and ends the protocol flow; wherein,

is a key string

Upper limit of error rate, P_eFor minimum rate P introducing errors in key generation process in the presence of an eavesdropper_e；

Step six: bob will sign the information (m, Sig)_m) Sending the information to Charlie;

step seven: charlie will receive signature information (m, Sig)_m) And

making a comparison if

In

Respectively with signature

The number of unmatched bits of corresponding position is less than s_vL/2, Charlie accepts this signature, otherwiseReject the signature; wherein,

s_v＞s_a。

the further improvement lies in that: in the presence of an eavesdropper Eve, the key string

The minimum entropy of (a) is:

wherein,

and H₂Are binary shannon entropy functions, satisfy: h (x) xlog₂(x)-(1-x)log₂(1-x); oa is the failure probability for parameter estimation, E denotes the eavesdropper Eve, andn _L,1and

are respectively a key string

The lower bound of the single photon counting and the upper bound of the single photon error rate, wherein U is B or C and represents a user Bob or Charlie.

The further improvement lies in that: when an eavesdropper Eve exists, the Eve pairs the key string in the key generation process

Minimum rate P of introduced error code_eComprises the following steps:

the further improvement lies in that: in the key distribution stage, the bits are generated by using TF-KGP by Alice and Bob, Alice and Charlie respectively, wherein the Alice and Bob or Alice and Charlie respectively send quantum states to a measuring party Eve, and the Eve measures the received quantum states.

The invention has the beneficial effects that: compared with the conventional QDS scheme, the scheme of the invention adopts the double-field key generation protocol at the key distribution stage, and the double-field key generation protocol can break the linear boundary between the conventional key rate and distance, so that the key which can be used for signature under the condition of meeting the given security is greatly increased, and the signature rate and the transmission distance of the quantum digital signature are improved; the invention has the property of independence of the measuring equipment, and can resist the attack to the measuring equipment, thereby ensuring the high security of the quantum digital signature system. The simulation result shows that the method has good performance in all aspects.

Drawings

FIG. 1 is a schematic diagram of the present invention.

Fig. 2 is a graph of the size of the medium key pool, the length of the half-bit signature, and the number of signature bits as a function of distance in accordance with the present invention.

FIG. 3 is a graph comparing the signature rate of the present invention with other schemes.

Fig. 4 is a graph of the relationship between the signature rate and the local bit error rate under different security in the present invention.

Detailed Description

For the purpose of enhancing understanding of the present invention, the present invention will be further described in detail with reference to the following examples, which are provided for illustration only and are not to be construed as limiting the scope of the present invention. The following describes the scheme of the present invention by taking a specific TF-KGP as an example, namely, the Sending or non-Sending dual field key generation protocol (SNS TF-KGP, Sending-or-Not-Sending TF-KGP). Meanwhile, the TF-QDS method is suitable for different types of TF-KGP protocols and is not limited to SNSTF-KGP protocols.

The contents of the TF-QDS protocol will be described in detail below:

a distribution stage: in the distribution stage, Alice, Bob and Charlie are the quantum state senders, Eve is the quantum state receiving measurer, and the distribution stage comprises the following steps:

(1) respectively generating N pulses by Alice-Bob/Alice-Charlie, encoding the pulses by using a strength modulator and a phase modulator, and then sending the pulses to Eve; during the encoding process, the number of the coding sequences is 1-p respectively_ZAnd p_ZIs random with probabilitySelecting a decoy state window and a signal state window to encode the pulse, wherein the two windows are respectively marked as an X window and a Z window; under the X window, each side of Alice and Bob is denoted by p_xRandom preparation of (2) sends a coherent state of intensity x, phase θ, where x ∈ {0, w, v }, x ∈ [0,2 π [ ]]Under the Z window, with p_sA signal state with a probability of transmission strength u, a probability of non-transmission 1-p_s(ii) a Taking Alice and Bob as examples, the coherent states prepared respectively can be characterized as follows:

where n is the number of photons in the pulse, x_AAnd x_BIntensity, θ, used by Alice and Bob, respectively_AAnd theta_BPhases prepared for Alice and Bob, respectively;

(2) eve uses a beam splitter and two detectors to perform projection measurement on the received pulse pair, and publishes the detection result, if only one of the two detectors responds, the event is recorded as a successful response event; two detectors are respectively marked as D₀,D₁；

(3) Alice-Bob/Alice-Charlie publicly announced that for the type of window they used for each pulse, only the measurements that were successful for them were retained, successful measurements being the successful response event of Eve when they used the same type of window, i.e. both X-windows or Z-windows; if they all use the X window, then the phase and decoy state strength of each pulse need to be published; in addition, a valid measurement result under an X window needs to be selected later, which is defined as (taking Alice-Bob as an example): both Alice and Bob used an X-window, the same intensity and phase for successful response events that satisfied the following condition:

wherein psi_ABIs the overall phase difference between Alice-to-Eve and Bob-to-Eve channels, which results in local bit errors e_dK is 0 or 1 represents AliThe phases of ce and Bob are in-phase or out-of-phase,

representing the size of a preset phase plate, wherein M is the number of the phase plates;

(4) Alice-Bob/Alice-Charlie generates an original key by using data under a Z window, and the generation rule is as follows (taking Alice and Bob as an example): for the successful measurement result under the Z window, if Alice sends a signal state, the signal state is recorded as 1, if not, the signal state is recorded as 0, otherwise, Bob; estimating channel parameters by using data under an X window, wherein correct and wrong response events in effective measurement results under the X window are as follows: for valid measurement results under the X window, the detector D when the correct response event is k 0₀Detector D with response or k 1₁In response, the detector D responds when the wrong response event is that k is 0₁Detector D with response or k 1₀Responding; in addition, they sacrifice the ratio r below the Z window at random_ETCarrying out error rate detection on the bits, and using the rest bits as a signature key pool; the lengths of the original key, the error rate detection and the key pool are n respectively_Z、n_testAnd n_poolThe bit error rate of Alice-Bob is

Alice-Charlie with a bit error rate of

(5) For the signature message m (m is 0 or 1), Alice and Bob, Alice and Charlie respectively select a bit string with the length of L from their key pools; let the bit strings selected by Alice and Bob be respectively

And

bit string selected by Alice and Charlie as

And

(6) bob and Charlie from

And

The bit information sent to Charlie is

Let Charlie retain bit information as

The bit information sent to Bob is

After the exchange, Bob's key string is

Charlie has a key string of

An information stage: in the information phase, Alice is used as a signer, Bob and Charlie are used as verifiers, and the information phase comprises the following steps:

(7) alice signs the information (m, Sig)_m) Sent to Bob, where Sig_mRepresenting the signature on the message m,

(8) bob will receive the signature (m)，Sig_m) And

comparing if

Are respectively connected with

The number of mismatching of the corresponding position bits is less than s_aL/2, Bob accepts the signature and carries out the next step, otherwise refuses the signature and terminates the protocol flow; wherein,

is a key string

Upper limit of error rate, P_eMinimum rate P for introducing errors in key generation process in the presence of eavesdropper_e；

(9) Bob will (m, Sig)_m) Sending the information to Charlie;

(10) charlie will receive signature information (m, Sig)_m) And

making a comparison if

Are respectively connected with

The number of mismatching of the corresponding position bits is less than s_vL/2, the Charlie accepts the signature, otherwise, the Charlie rejects the signature; wherein,

s_v＞s_a。

definition P_abThe probability with the strength of a and b is respectively sent by two parties carrying out TF-KGP under an X window,

is the probability of sending a valid event under the window X, where a, b ∈ {0, w, v }. two probabilities can be characterized as:

the number of pulses correspondingly transmitted is N_ab＝P_abN,

Similarly, both parties performing TF-KGP select the number of pulses in the Z window as

Definition of n_ZThe count under the Z window obtained by measurement in the TF-KGP process, i.e. the number of the original keys, can be characterized by the following size:

wherein,

is the penetration of the channel, η_dα is the loss coefficient of the channel for the detection efficiency of the detector, theta_AU＝θ_A-θ_UAnd preparing phase difference for the TF-KGP. Definition of n_abFor the counts of the TF-KGP two sides with the intensity combination of a and b under the X window, the required intensity combination for estimating the single photon count is {00,0w, w0,0v, v0}, and the counts can be characterized as follows:

n₀₀＝2P_dc(1-P_dc)N₀₀, (5)

n_0w＝n_w0＝2[(1-P_dc)e^ηw/2-(1-P_dc)²e^-ηw]N_0w, (6)

n_0v＝n_v0＝2[(1-P_dc)e^ηv/2-(1-P_dc)²e^-ηv]N_0v, (7)

wherein, P_dcIs the dark count rate of the detector. In addition, m is defined_aaThe number of response events of errors under an X-base window, namely error code counting, is used for estimating the error rate of a single photon, and can be characterized as follows:

by using the count value in the formula (5-8), we can estimate that the lower bound of the single photon count and the single photon error code count under the X window are respectively:

wherein, tau_X,1The probability of all single photon components under an X window during transmission can be characterized as follows:

and

are each n_abThe upper and lower bounds after statistical fluctuation are considered,

and

are respectively m_aaThe upper and lower bounds after statistical fluctuations are considered. For example, for the variable χ, the upper and lower bounds after accounting for statistical fluctuations using the Hoeffding inequality are:

χ⁺＝χ+(χ，_SF)，χ^-＝χ-(χ，_SF)， (12)

wherein oa is_SFThe probability of failure in statistical fluctuations is taken into account for a certain observation.

Lower bound of single photon counting using X-windown _X,1And upper bound of single photon error code counting

The lower bound of the single photon counting number and the upper bound of the single photon error code counting number in the original key under the Z window can be estimated by using the Serfling inequality, and the estimation relationship is as follows:

wherein

N _Z,1Is the lower bound of the number of single photons under the transmit end Z window,

which is an upper bound on the number of single photons under the X window of the transmitting end, they can be characterized as:

N _Z,1＝2p_s(1-p_s)ue^-uN_Z-(N_Z,ò_SF), (16)

the failure probabilities of the formulae (14-15) are all oa_SFAccording to the two formulas, the single photon error rate under the Z window is obtained as follows:

the lower bound of single photon counting in the original key and the upper bound of single photon error rate are respectivelyn _Z,1And

the key string can be estimated by using the Serfling inequality

The lower bound of single photon counting and the upper bound of single photon error rate have the following estimation relationship:

wherein

According to the single photon counting lower bound and the single photon error rate upper bound estimated by the formula (19-20), the key string can be obtained under the condition that an eavesdropper Eve exists

The minimum entropy of (a) is:

wherein,

and H₂Are binary shannon entropy functions, satisfy: h (x) xlog₂(x)-(1-x)log₂(1-x); oa is the failure probability for parameter estimation, E denotes the eavesdropper Eve. Eve pairs key string in TF-KGP process

Minimum rate P of introducing error code_eComprises the following steps:

aiming at the safety analysis of TF-QDS, the scheme of the invention comprehensively considers the robustness probability, the false probability and the repudiation probability. The robustness probability is the failure probability of the protocol when the system normally operates, and the key string is estimated mainly by the detected error rate

The estimation relation caused by the failure of the medium bit error rate is as follows:

the estimated failure probability is oa_PETwo TF-KGP processes of Alice-Bob and Alice-Charlie

Has an upper bound on the error rate of

Therefore, the robustness probability of TF-QDS is:

P(Robust)2ò_PE。 (24)

the probability of denial is a measure of the probability that Alice's signature is accepted by Bob but rejected by Charlie. For repudiation, Alice needs to have her issued signature (m, Sig)_m) And

mismatch ratio of two partsIs less than s_aTo and with

The mismatching rate of the two parts is higher than s_v. Thus, the probability of denial is:

wherein

The probability of forgery is a measure of the probability that Bob falsely makes Alice's signature acceptable to Charlie. In order to forge a signature, Bob needs a signature (m, Sig) that makes him forged_m) And

in

Has a mismatch rate lower than s_v. Hence the probability of forgery contains Bob's guesses

Probability of failure for all procedures:

g and oa_FError rate with Bob forged signature is less than s_vIs g a predetermined constant probability, oa is a predetermined probability of being constant_FIs defined as:

and

are respectively estimated parametersn _L,1And

the probability of failure of (c). In summary, the security of the protocol needs to be satisfied

max{P(Robust),P(Repudiation),P(Forge)}。 (28)

To measure the performance of the TF-QDS protocol, the number of signature bits n of the protocol is defined_bitsAnd the signature rate R is:

in order that the objects, aspects and advantages of the present invention will become more apparent, the invention will be further described in detail with reference to the accompanying drawings.

In the simulation scheme of the invention, the number M of the phase plates is 16, and other used system parameters are shown in the table I, wherein α is the loss coefficient of the quantum channel, η_dAnd P_dcThe detection efficiency and the dark count rate of the detector are respectively; e.g. of the type_dThe background bit error rate of the optical system; r is_ETSelecting the proportion for carrying out error rate detection in the original key; oa_PEAnd oa_SFRespectively the failure probability of the error rate estimation and the failure probability of the statistical fluctuation estimation; g is the probability associated with forgery. In addition, under the given security size, the signature rate of the TF-QDS is subjected to full-parameter optimization, and the optimized parameters comprise: strength of spoofed state w, v and corresponding probability of selection p_w，p_vSelection probability p of Z window_ZThe strength u of the signal state and the transmission probability p_s。

TABLE I

α

η_d

P_dc

e_d

r_ET

ò_PE

ò_SF

g

0.2dB/km

50％

10^-7

0.03

5.5％

10^-12

Fig. 2 first shows that the pulse number N is 10¹³Security of 10^-5Time, key pool size n in TF-QDS_poolLength L required by signature half bit and signature bit number n_bitsTrend with transmission distance. It can be seen from the figure that at greater than 250km, the length required to sign a half bit increases dramatically with increasing distance, while the number of bits that can be signed decreases dramatically. This indicates that at long distances, the impact of the finite length effect increases rapidly, requiring a longer key amount to securely sign half bits。

FIG. 3 shows that the pulse number is N-10¹³Or N10¹⁵Security of 10^-5The signature rate of TF-QDS is plotted against the signature rate of the other two representative schemes. These two protocols are BB84-QDS and MDI-QDS, BB84-QDS from the literature [ R.Amiri, P.Wallden, A. Kent, and E.Andersson, Secure quantum signatures using the same quantum channels, Phys.Rev.A 93,032325(2016)]MDI-QDS from the literature [ I.V.Puthoor, R.Amiri, P.Wallden, M.Current, and E.Andersson, Measurement-device-independent rectangle derivatives, Phys.Rev.A 94,022328(2016)]. For fair comparison, the signature rates for these two schemes in simulation also use the parameters in table I and are optimized for full parameters. As can be seen from FIG. 3, the TF-QDS has a far-beyond transmission distance of BB84-QDS and MDI-QDS and a far-distance signature rate. The BB84-QDS has a higher signature rate at close range, but has a low security level and cannot resist side channel attacks against the measuring device. Furthermore, it can be seen that the TF-QDS is affected by a finite length between BB84-QDS and MDI-QDS.

FIG. 4 shows that N is 10 at 50km¹³Security of 10^-5Or 10^-10And (3) the trend that the signature rate of the TF-QDS changes along with the background bit error rate. As can be seen, the TF-QDS can tolerate 18% of the background error rate under the condition, which is far beyond the sustainable background error rate of BB84-QDS and MDI-QDS. Furthermore, a higher security level means that a certain signature rate will be sacrificed.

In summary, the present invention proposes a quantum digital signature method based on a two-field protocol, and has been described in detail using a send-or-not two-field key generation protocol as a specific example. The specific simulation proves that the QDS system using the method can simultaneously take safety and practicability into consideration, namely, the QDS system has the independent safety level of the measuring equipment and is obviously improved in the aspects of safe transmission distance and signature efficiency compared with the existing QDS protocol.

The above description is only of the preferred embodiments of the present invention, and it should be noted that: it will be apparent to those skilled in the art that various modifications and enhancements may be made without departing from the principles of the invention by using different two-field protocols, different spoofing methods, different finite length effects, different light sources, different implementation architectures (system-on-chip, free space system, fiber optic system, etc.), and the like, and such modifications and enhancements are also considered to be within the scope of the invention.

Claims

1. A quantum digital signature method based on a double-field protocol is characterized in that: the method adopts a double-field protocol to generate and sign a secret key, is applied to a Quantum Digital Signature (QDS) transmission system, and comprises a secret key distribution stage and an information stage, wherein the secret key distribution stage comprises user parties including Alice, Bob, Charlie and a measuring party Eve, in the secret key distribution stage, Alice, Bob and Charlie are quantum state sending parties, and Eve is a quantum state receiving and measuring party; the key distribution phase comprises the following three steps:

Alice-Charlie with a bit error rate of

And

the bit strings selected by Alice and Charlie are respectively

And

step three: bob and Charlie from

And

The bit information sent to Charlie is

Let Charlie retain bit information as

The bit information sent to Bob is

After the exchange, Bob's key string is

Charlie has a key string of

step five: bob will receive the signature (m, Sig)_m) And

comparing if

In (1)

Respectively with signature

is a key string

Step six: bob sends the signature information (m,Sig_m) Sending the information to Charlie;

step seven: charlie will receive signature information (m, Sig)_m) And

making a comparison if

In

Respectively with signature

2. a quantum digital signature method based on a two-field protocol as claimed in claim 1 wherein: in the presence of an eavesdropper Eve, the key string

The minimum entropy of (a) is:

wherein,

and H₂Are binary shannon entropy functions, satisfy: h (x) xlog₂(x)-(1-x)log₂(1-x); oa is the failure probability for parameter estimation, E denotes the eavesdropper Eve, and n_L,1And

are respectively a key string

The lower bound of single photon counting and the upper bound of single photon error rate, wherein U is B or C, and represents the user Bob or Charlie.

3. A quantum digital signature method based on a two-field protocol as claimed in claim 2, characterized in that: when an eavesdropper Eve exists, the Eve pairs the key string in the key generation process

Minimum rate P of introduced error code_eComprises the following steps:

4. a quantum digital signature method based on a two-field protocol as claimed in claim 1 wherein: in the key distribution stage, the bits are generated by using TF-KGP by Alice and Bob, Alice and Charlie respectively, wherein the Alice and Bob or Alice and Charlie respectively send quantum states to a measuring party Eve, and the Eve measures the received quantum states.